CVE-2026-13001 is a critical vulnerability in the Podlove Podcast Publisher WordPress plugin caused by missing file type validation in the 'podlove_handle_cache_files' function. This improper input validation (CWE-20) enables unauthenticated attackers to upload arbitrary files to the server hosting the plugin, which may lead to remote code execution. The vulnerability affects all versions up to and including 4.5.1. The CVSS 3.1 base score is 9.8, reflecting its critical impact with network attack vector, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. As of the published date, no patch or official remediation level has been provided by the vendor.

The vulnerability allows unauthenticated remote attackers to upload arbitrary files to the server, which can lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system, potentially allowing full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's upload functionality and consider disabling or removing the Podlove Podcast Publisher plugin if possible to reduce exposure.